=========
Aristotle
=========
Aristotle is a simple Python program that allows for the filtering and modifying of
Suricata and Snort rulesets based on interpreted key-value pairs present
in the metadata keyword within each rule. It can be run as a standalone
script or utilized as a module.
.. image:: docs/_static/aristotle.png
Documentation
=============
`<https://aristotle-py.readthedocs.io/>`__
Application Overview
====================
Aristotle takes in a ruleset and can provide statistics on the included
metadata keys. If a filter string is provided, it will also be applied
against the ruleset and the filtered ruleset outputted.
Aristotle also offers the ability to intelligently process rules to extract, enrich, and add
metadata to them. After initial filtering, rules can additionally
undergo "Post Filter Modification" which can modify them
based on user-defined criteria, to help ensure the resulting
rules in the ruleset are enabled, configured, and optimized for the target environment.
Aristotle is compatible with Python 2.7 and Python 3.x.
+------------------------------------------------------------------------------------+
| In order for Aristotle to be most useful, it should be provided a ruleset that |
| has rules with the metadata keyword populated with appropriate key-value |
| pairs. Aristotle assumes that the provided ruleset conforms to the |
| `BETTER Schema <https://better-schema.readthedocs.io/>`__. |
+------------------------------------------------------------------------------------+
Setup
=====
Install dependencies:
``pip install -r requirements.txt``
Or if using as a module:
``pip install aristotle``
And refer to `Aristotle as a Module <https://aristotle-py.readthedocs.io/en/latest/module.html>`__.
Usage
=====
.. code:: console
usage: aristotle.py [-h] -r RULES [-f METADATA_FILTER]
[--summary [DISPLAY_MAX]] [-o OUTFILE]
[-s [STATS [STATS ...]]] [-i] [-c] [-n] [-e] [-t] [-g]
[-m] [-p PFMOD_FILE] [-q] [-d]
Filter Suricata and Snort rulesets based on metadata keyword values.
optional arguments:
-h, --help show this help message and exit
-r RULES, --rules RULES, --ruleset RULES
path to a rules file, a directory containing '.rules'
file(s), or string containing the ruleset
-f METADATA_FILTER, --filter METADATA_FILTER
Boolean filter string or path to a file containing it
--summary [DISPLAY_MAX]
output a summary of the filtered ruleset to stdout,
limited to DISPLAY_MAX number of lines (or 16 if no
value given); if the option to output to a file is
set, the full, filtered ruleset will still be written.
-o OUTFILE, --output OUTFILE
output file to write filtered ruleset to
-s [STATS [STATS ...]], --stats [STATS [STATS ...]]
display ruleset statistics about specified key(s). If
no key(s) supplied, then summary statistics for all
keys will be displayed.
-i, --enable-all-rules, --enable-all, --include-disabled
enable all valid rules, including those
disabled/commented out in the given rules file(s),
when applying the filter
-c, --output-disabled-rules
include disabled rules in the output as commented out
lines.
-n, --normalize, --better, --iso8601
try to convert date and cve related metadata values to
conform to the BETTER schema for filtering and
statistics. Dates are normalized to the format YYYY-
MM-DD and CVEs to YYYY-<num>. Also, 'sid' is removed
from the metadata.
-e, --enhance enhance metadata by adding additional key-value pairs
based on the rules.
-t, --ignore-classtype, --ignore-classtype-keyword
don't incorporate the 'classtype' keyword and value
from the rule into the metadata structure for
filtering and reporting.
-g, --ignore-filename
don't incorporate the 'filename' keyword (filename of
the rules file) into the metadata structure for
filtering and reporting.
-m, --modify-metadata
modify the rule metadata keyword value on output to
contain the internally tracked and normalized metadata
data.
-p PFMOD_FILE, --pfmod PFMOD_FILE, --pfmod-file PFMOD_FILE
YAML file of directives to apply actions on post-
filtered rules based on filter strings.
-q, --quiet, --suppress_warnings
quiet; suppress warning logging
-d, --debug turn on debug logging
A filter string defines the desired outcome based on Boolean logic, and uses
the metadata key-value pairs as values in a (concrete) Boolean algebra.
The key-value pair specifications must be surrounded by double quotes.
Example:
python3 aristotle/aristotle.py -r examples/example.rules --summary -n
-f '(("priority high" AND "malware <ALL>") AND "created_at >= 2018-01-01")
AND NOT ("protocols smtp" OR "protocols pop" OR "protocols imap") OR "sid 80181444"'
License
=======
Aristotle is licensed under the `Apache License, Version 2.0 <https://github.com/secureworks/aristotle/blob/master/LICENSE>`__.
Authors
=======
- David Wharton
Raw data
{
"_id": null,
"home_page": "https://github.com/secureworks/aristotle",
"name": "aristotle",
"maintainer": "",
"docs_url": null,
"requires_python": ">=2.7",
"maintainer_email": "",
"keywords": "suricata,snort,metadata,ruleset,BETTER,IDS,IPS,NIDS,signatures",
"author": "David Wharton",
"author_email": "",
"download_url": "https://files.pythonhosted.org/packages/8d/27/beaf77f0c505a3867c55c25b55992fa1bef9987659ba92856b52b2b1a186/aristotle-2.0.0.tar.gz",
"platform": null,
"description": "=========\nAristotle\n=========\n\nAristotle is a simple Python program that allows for the filtering and modifying of\nSuricata and Snort rulesets based on interpreted key-value pairs present\nin the metadata keyword within each rule. It can be run as a standalone\nscript or utilized as a module.\n\n.. image:: docs/_static/aristotle.png\n\nDocumentation\n=============\n\n`<https://aristotle-py.readthedocs.io/>`__\n\nApplication Overview\n====================\n\nAristotle takes in a ruleset and can provide statistics on the included\nmetadata keys. If a filter string is provided, it will also be applied\nagainst the ruleset and the filtered ruleset outputted.\n\nAristotle also offers the ability to intelligently process rules to extract, enrich, and add\nmetadata to them. After initial filtering, rules can additionally\nundergo \"Post Filter Modification\" which can modify them\nbased on user-defined criteria, to help ensure the resulting\nrules in the ruleset are enabled, configured, and optimized for the target environment.\n\nAristotle is compatible with Python 2.7 and Python 3.x.\n\n+------------------------------------------------------------------------------------+\n| In order for Aristotle to be most useful, it should be provided a ruleset that |\n| has rules with the metadata keyword populated with appropriate key-value |\n| pairs. Aristotle assumes that the provided ruleset conforms to the |\n| `BETTER Schema <https://better-schema.readthedocs.io/>`__. |\n+------------------------------------------------------------------------------------+\n\nSetup\n=====\n\nInstall dependencies:\n\n``pip install -r requirements.txt``\n\nOr if using as a module:\n\n``pip install aristotle``\n\nAnd refer to `Aristotle as a Module <https://aristotle-py.readthedocs.io/en/latest/module.html>`__.\n\nUsage\n=====\n\n.. code:: console\n\n usage: aristotle.py [-h] -r RULES [-f METADATA_FILTER]\n [--summary [DISPLAY_MAX]] [-o OUTFILE]\n [-s [STATS [STATS ...]]] [-i] [-c] [-n] [-e] [-t] [-g]\n [-m] [-p PFMOD_FILE] [-q] [-d]\n\n Filter Suricata and Snort rulesets based on metadata keyword values.\n\n optional arguments:\n -h, --help show this help message and exit\n -r RULES, --rules RULES, --ruleset RULES\n path to a rules file, a directory containing '.rules'\n file(s), or string containing the ruleset\n -f METADATA_FILTER, --filter METADATA_FILTER\n Boolean filter string or path to a file containing it\n --summary [DISPLAY_MAX]\n output a summary of the filtered ruleset to stdout,\n limited to DISPLAY_MAX number of lines (or 16 if no\n value given); if the option to output to a file is\n set, the full, filtered ruleset will still be written.\n -o OUTFILE, --output OUTFILE\n output file to write filtered ruleset to\n -s [STATS [STATS ...]], --stats [STATS [STATS ...]]\n display ruleset statistics about specified key(s). If\n no key(s) supplied, then summary statistics for all\n keys will be displayed.\n -i, --enable-all-rules, --enable-all, --include-disabled\n enable all valid rules, including those\n disabled/commented out in the given rules file(s),\n when applying the filter\n -c, --output-disabled-rules\n include disabled rules in the output as commented out\n lines.\n -n, --normalize, --better, --iso8601\n try to convert date and cve related metadata values to\n conform to the BETTER schema for filtering and\n statistics. Dates are normalized to the format YYYY-\n MM-DD and CVEs to YYYY-<num>. Also, 'sid' is removed\n from the metadata.\n -e, --enhance enhance metadata by adding additional key-value pairs\n based on the rules.\n -t, --ignore-classtype, --ignore-classtype-keyword\n don't incorporate the 'classtype' keyword and value\n from the rule into the metadata structure for\n filtering and reporting.\n -g, --ignore-filename\n don't incorporate the 'filename' keyword (filename of\n the rules file) into the metadata structure for\n filtering and reporting.\n -m, --modify-metadata\n modify the rule metadata keyword value on output to\n contain the internally tracked and normalized metadata\n data.\n -p PFMOD_FILE, --pfmod PFMOD_FILE, --pfmod-file PFMOD_FILE\n YAML file of directives to apply actions on post-\n filtered rules based on filter strings.\n -q, --quiet, --suppress_warnings\n quiet; suppress warning logging\n -d, --debug turn on debug logging\n\n A filter string defines the desired outcome based on Boolean logic, and uses\n the metadata key-value pairs as values in a (concrete) Boolean algebra.\n The key-value pair specifications must be surrounded by double quotes.\n Example:\n\n python3 aristotle/aristotle.py -r examples/example.rules --summary -n\n -f '((\"priority high\" AND \"malware <ALL>\") AND \"created_at >= 2018-01-01\")\n AND NOT (\"protocols smtp\" OR \"protocols pop\" OR \"protocols imap\") OR \"sid 80181444\"'\n\nLicense\n=======\n\nAristotle is licensed under the `Apache License, Version 2.0 <https://github.com/secureworks/aristotle/blob/master/LICENSE>`__.\n\nAuthors\n=======\n\n- David Wharton\n",
"bugtrack_url": null,
"license": "",
"summary": "Script and library for the viewing, filtering, and modifying of Suricata and Snort rulesets based on interpreted key-value pairs present in the metadata keyword within each rule.",
"version": "2.0.0",
"project_urls": {
"Documentation": "https://aristotle-py.readthedocs.io/",
"Homepage": "https://github.com/secureworks/aristotle",
"Source": "https://github.com/secureworks/aristotle"
},
"split_keywords": [
"suricata",
"snort",
"metadata",
"ruleset",
"better",
"ids",
"ips",
"nids",
"signatures"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "363a453daef565ff2a95f9d5bb4f6f5b1e5fce3c4b7c7343359c441546d5442e",
"md5": "50f5c2449749604b7a039f0795ae6bdf",
"sha256": "85847361adcf29b10499450c4b9dc587b0b9aebc70750732566c4ea278631f16"
},
"downloads": -1,
"filename": "aristotle-2.0.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "50f5c2449749604b7a039f0795ae6bdf",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=2.7",
"size": 28067,
"upload_time": "2023-09-23T03:08:04",
"upload_time_iso_8601": "2023-09-23T03:08:04.780856Z",
"url": "https://files.pythonhosted.org/packages/36/3a/453daef565ff2a95f9d5bb4f6f5b1e5fce3c4b7c7343359c441546d5442e/aristotle-2.0.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "8d27beaf77f0c505a3867c55c25b55992fa1bef9987659ba92856b52b2b1a186",
"md5": "ed29d16a7d28c0ef22a3d2546b0b512d",
"sha256": "e4b856c0d37d726ccf5562150b7d455c21e70549664605f00ba7ca89223e3f8d"
},
"downloads": -1,
"filename": "aristotle-2.0.0.tar.gz",
"has_sig": false,
"md5_digest": "ed29d16a7d28c0ef22a3d2546b0b512d",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=2.7",
"size": 28764,
"upload_time": "2023-09-23T03:08:06",
"upload_time_iso_8601": "2023-09-23T03:08:06.303758Z",
"url": "https://files.pythonhosted.org/packages/8d/27/beaf77f0c505a3867c55c25b55992fa1bef9987659ba92856b52b2b1a186/aristotle-2.0.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2023-09-23 03:08:06",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "secureworks",
"github_project": "aristotle",
"travis_ci": false,
"coveralls": false,
"github_actions": false,
"requirements": [],
"lcname": "aristotle"
}
JSON
